Executive brief
A vulnerability in MongoDB Server allows an authenticated user to crash the database service by sending specifically crafted queries. By exploiting how the system processes certain bitwise search operations, an attacker can force the server to consume all available memory, leading to a denial-of-service. This impacts the availability of the database and any applications relying on it for operations.
Technical details
A resource exhaustion vulnerability (CWE-1325) exists in MongoDB Server's Abstract Syntax Tree (AST) processing for bitwise match expressions. An authenticated attacker can provide malicious input to operators such as $bitsAllSet, $bitsAnySet, $bitsAllClear, or $bitsAnyClear to trigger improperly controlled sequential memory allocation. This results in excessive memory pressure and can lead to a service crash via an Out of Memory (OOM) event. The vulnerability is reachable over the network but requires valid user credentials. Patches have been released in versions 7.0.34, 8.0.23, 8.2.9, and 8.3.2.
Affected products
- MongoDB MongoDB Server 7.0.0 to 7.0.33, 8.0.0 to 8.0.22, 8.2.0 to 8.2.8, 8.3.0 to 8.3.1
Timeline
- 2026-03-23: other: Issue created in MongoDB Jira
- 2026-05-12: patched: Issue resolved/fixed in development
- 2026-05-13: advisory: NVD advisory published